CVE-2009-0737 Information

Description

Multiple cross-site scripting (XSS) vulnerabilities in the web-based installer (config/index.php) in MediaWiki 1.6 before 1.6.12 1.12 before 1.12.4 and 1.13 before 1.13.4 when the installer is in active use allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.

Reference

http://lists.wikimedia.org/pipermail/mediawiki-announce/2009-February/000083.html http://secunia.com/advisories/33881 http://svn.wikimedia.org/svnroot/mediawiki/tags/REL1_12_4/phase3/RELEASE-NOTES http://svn.wikimedia.org/svnroot/mediawiki/tags/REL1_13_4/phase3/RELEASE-NOTES http://svn.wikimedia.org/svnroot/mediawiki/tags/REL1_6_12/phase3/RELEASE-NOTES http://www.debian.org/security/2009/dsa-1901 http://www.securityfocus.com/bid/33681 http://www.vupen.com/english/advisories/2009/0368